MalwareIncident Response & Malware AnalysisRansomware & Threat ResponseHandle a ransomware attack from first call to recovery, reporting and lessons learnt.ISO/IEC 27043:2015 Incident Investigation Principles and Processes
ISO/IEC 27043:2015 is the map of the whole investigation, from preparing before anything goes wrong to closing the case. The other ISO/IEC forensic standards are its chapters in detail.
StandardISO/IEC2015 (first edition)Current edition, confirmed 2020; 2025 systematic review closed, result not yet shownReviewed 2 November 2026
ISO/IEC 27043:2015, Information technology, Security techniques, Incident investigation principles and processes, is a 30-page standard from ISO/IEC JTC 1/SC 27. Its abstract says it provides guidelines based on idealised models for common incident investigation processes across various scenarios involving digital evidence, from pre-incident preparation through investigation closure, and that it applies to incidents such as unauthorised access, data corruption, system crashes and corporate information security breaches as well as any other digital investigation.
The abstract is equally clear about what it is not. It gives a general overview of principles and processes without prescribing details within each one, and it refers to other standards for the detail. That is its job: to be the frame that ISO/IEC 27037:2012, ISO/IEC 27041:2015 and ISO/IEC 27042:2015 fit into, and to make investigations done by different organisations comparable.
The word idealised is chosen with care. The models describe how an investigation should be arranged when nothing gets in the way. A real laboratory adapts them to its mandate, its law and its clients, and the standard expects that.
Status and Edition
The first edition was published on 4 March 2015. ISO's life-cycle record shows a systematic review that opened in January 2020 and ended with confirmation on 23 September 2020, and the catalogue says this version remains current. A second systematic review opened on 15 July 2025 and closed on 3 December 2025. As of our check on 2 November 2026 the catalogue has not recorded whether the 2015 text was confirmed again or sent for revision, so a laboratory should check the catalogue before quoting the edition in a new procedure. The text is paid; this page describes it from the abstract, the catalogue, the preview and reputable summaries.
The Five Process Classes
The standard groups every investigation activity into five classes, which appear as clauses 7 to 11 after an overview of digital investigations in clauses 5 and 6. Clause 12 draws them into a single process model schema and Annex A explains why harmonisation was needed.
- Readiness Processes
Everything done before an incident so that evidence will exist and be usable when one happens: policy, logging, retention, trained people, tested tools and agreements with service providers.
- Initialisation Processes
What happens when an incident is suspected: detection, first response, planning the investigation and preparing the resources and authorisations it will need.
- Acquisitive Processes
Identifying, collecting, transporting and storing potential evidence. This is where ISO/IEC 27037:2012 supplies the detail.
- Investigative Processes
Acquisition of the data from the stored exhibits, examination, analysis, interpretation, reporting, presentation and closure. ISO/IEC 27042:2015 covers the middle of this chain.
- Concurrent Processes
Things that run through all the others at once: obtaining authorisation, documenting, managing information flow, preserving the chain of custody, preserving the evidence itself and interacting with any physical investigation.
Key Terms
C
- Closure
- The formal end of an investigation, including return or disposal of exhibits and the recording of lessons for the readiness processes of the next one.
- Concurrent Process
- An activity, such as documentation or chain of custody, that is not a stage but a thread running through every stage.
D
- Digital Investigation
- The standard's general term for a process that uses digital evidence to establish what happened, whether for a court, a disciplinary hearing or an internal lesson.
H
- Harmonisation
- The purpose stated in Annex A: giving investigators in different organisations and countries one set of process names so that their work can be compared and combined.
I
- Idealised Model
- A description of a process arranged as it should be in principle, intended to be adapted, not copied. The standard says so in its abstract.
R
- Readiness
- The state of being prepared to investigate. In practice this is the part most organisations in India skip and the reason so many investigations begin with missing logs.
How a Laboratory Applies It
A generic example: a mid-sized company suffers a ransomware incident and its internal security team and an external laboratory investigate together.
- 01Readiness Before the Incident
The company already keeps system logs, has a written policy on who may examine staff devices and has an engagement agreement with the laboratory. The laboratory has validated tools and competent staff on record.
- 02Initialisation
On detection the security team records the time, isolates the affected hosts without wiping them, obtains management authorisation for the investigation and briefs the laboratory on scope.
- 03Acquisitive Work to ISO/IEC 27037:2012
Memory is captured from the running servers, disks are imaged through write blockers, hashes are recorded and exhibits move to the laboratory under a chain of custody.
- 04Investigative Work to ISO/IEC 27042:2015
The laboratory analyses the images and memory, interprets the findings on how the attacker got in and reports them separately from the facts. Any new method is validated under ISO/IEC 27041:2015 before use.
- 05Concurrent Processes Throughout
Every action is documented, every transfer is logged, information flows to the incident manager and to counsel through one named channel, and the authorisation is checked again whenever scope widens.
- 06Closure and Lessons
Exhibits are returned or sanitised under the retention policy, the report is filed and the gaps found, for example a server whose logs were not kept, go back into the readiness processes.
What It Does Not Do and Common Misunderstandings
- It is not an incident management standard. Detecting, containing and recovering from incidents is the subject of the ISO/IEC 27035 series; ISO/IEC 27043:2015 covers the investigation of the incident.
- It is not a procedure. It gives no checklist a technician can follow on the day; it gives the structure the laboratory's own procedures should fit.
- It names no tools and sets no technical requirements.
- It is a guideline, not a law. In India the duties to report incidents come from the CERT-In directions of 2022 and, for personal data breaches, from the Digital Personal Data Protection Rules, 2025; this standard helps you organise the investigation that follows, nothing more.
- It is not a certificate. No body certifies a laboratory to it, and accreditation is a separate assessment against ISO/IEC 17025, carried out in India by NABL.
- Readiness is the part most often ignored. A laboratory that quotes the standard without having logs, policies and agreements in place before the incident is quoting half of it.
How It Fits With the Other Standards on This Site
ISO/IEC 27043:2015 is the umbrella. ISO/IEC 27037:2012 fills in its acquisitive processes, ISO/IEC 27042:2015 fills in the investigative ones and ISO/IEC 27041:2015 provides the assurance that the methods used anywhere in the model are fit for purpose. A laboratory that maps its quality system to these four can point to the clause of ISO/IEC 27043:2015 under which each of its procedures sits.
On the NIST side, NIST SP 800-86 describes a four-phase forensic process for incident response that fits inside the acquisitive and investigative classes, and NIST SP 800-61 Rev. 3 of April 2025 covers the incident response programme around it. The SWGDE Best Practices for Digital Evidence Collection (18-F-002, version 2.0) and the SWGDE guidance on establishing a quality management system under ISO/IEC 17025 or ISO/IEC 17020 are the practical companions for a laboratory building its readiness.
Common Questions
Is this standard for laboratories or for companies?
Both. The readiness and initialisation classes are mostly the organisation's job, the acquisitive and investigative classes are mostly the laboratory's, and the concurrent processes belong to everyone involved.
Do we need all four ISO/IEC investigation standards?
If you want the full picture, yes, and a reader of any one of them will keep meeting references to the others. A laboratory that only acquires evidence can start with ISO/IEC 27037:2012 and this one.
What should we do about the 2025 review?
Check the ISO catalogue when you next revise your procedures. If the standard is confirmed, nothing changes. If a revision is announced, follow the draft so that your process names do not fall out of step.
Official sources
This page is educational material, not legal advice. Laws and standards change, commence on different dates and are interpreted differently across jurisdictions. Always read the official text linked on this page and take advice from a qualified professional for a real matter.
Disciplines where this applies
Courses that teach it
MalwareIncident Response & Malware AnalysisRansomware & Threat ResponseHandle a ransomware attack from first call to recovery, reporting and lessons learnt.
LegalFoundation & Legal CoursesBasics of Cyber ForensicsStart here. Evidence handling, imaging, hashing, chain of custody and your first analysis.
LegalFoundation & Legal CoursesLegal & Court ProceduresIndian law on electronic evidence: BSA Section 63, BNSS search and seizure and the IT Act.Go deeper with DFRTI
Free pages explain the ground. Structured courses, lab work and a mentor take you from knowing about it to doing it on a case.